# Web Misconfiguration Scan

- **URL:** https://hackindex.io/services/web/vulnerability-discovery/misconfiguration-scan
- **Path:** HTTP/HTTPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md)
- **Published:** 2026-01-23
- **Updated:** 2026-03-28

Nuclei is the fastest way to confirm known misconfigurations, exposed interfaces, and weak configuration before you go manual. Template-based scanning gives you consistent, reproducible results across all targets. Run this early in vulnerability discovery: results tell you which manual paths are worth pursuing and which checks you can skip.

- **Baseline scan** runs a full severity sweep with nuclei to surface credentials, debug consoles, and known CVEs.
- **Tag-based targeting** narrows scans to misconfig, exposure, or tech-stack-specific templates.
- **Bulk host scanning** feeds httpx or subdomain output into nuclei for wide-scope coverage.
- **Security header check** confirms missing CSP, X-Frame-Options, and HSTS with a manual curl.
- **nikto fallback** covers server-specific checks when nuclei templates do not have full coverage.

Cross-reference nuclei findings with [HTTP tech fingerprinting](https://hackindex.io/services/web/enumeration/http-tech-fingerprinting) headers and [HTTP header analysis](https://hackindex.io/services/web/enumeration/http-header-analysis). Missing security headers flagged by nuclei map directly to XSS and clickjacking attack surface. Pair these scans with [information disclosure checks](https://hackindex.io/services/web/vulnerability-discovery/information-disclosure-checks) for exposed debug endpoints and leaked credentials.

## Nuclei Baseline Scan

Run a full severity sweep first. Treat every finding as a lead until you reproduce it with a direct request:

```bash
nuclei -u http://$TARGET_IP:$PORT/ -severity low,medium,high,critical
```

```bash
nuclei -u https://$DOMAIN/ -severity low,medium,high,critical
```

Prioritize findings that expose credentials, debug consoles, directory listings, authentication bypasses, or known CVEs. Anything that returns 200 with sensitive content warrants an immediate manual follow-up request.

## Narrow to Relevant Template Tags

Targeting specific tags reduces noise and speeds up the scan when you already know the tech stack:

```bash
nuclei -u https://$DOMAIN/ -tags misconfig,exposure,tech -severity low,medium,high,critical
```

```bash
nuclei -u https://$DOMAIN/ -tags php,apache,nginx,iis -severity medium,high,critical
```

## Scan Multiple Hosts

Feed a host list from subdomain bruteforce or httpx output into nuclei for bulk scanning:

```bash
nuclei -l live_hosts.txt -severity low,medium,high,critical -o nuclei_results.txt
```

```bash
nuclei -l live_hosts.txt -tags misconfig,exposure -jsonl -o nuclei.jsonl
```

JSONL output is easier to parse and filter when dealing with many findings across multiple hosts.

## Update Templates Before Scanning

Template updates happen frequently. Run an update before any engagement to catch recent CVE templates:

```bash
nuclei -update-templates
```

## Manual Security Header Check

Nuclei catches missing headers but a quick manual curl confirms and documents them for reporting:

```bash
curl -skI https://$DOMAIN/ | grep -iE 'content-security-policy|x-frame-options|strict-transport-security|x-content-type-options|permissions-policy|referrer-policy'
# x-frame-options: SAMEORIGIN
# x-content-type-options: nosniff
```

Missing `Content-Security-Policy` enables XSS exploitation without needing a CSP bypass. Missing `X-Frame-Options` enables clickjacking. Both are findings in their own right and lower the bar for [XSS exploitation](https://hackindex.io/services/web/vulnerability-discovery/reflected-xss-checks).

## nikto as Fallback

> [!WARNING]
> nikto is noisy and generates significant log entries. Nuclei templates are more targeted and easier to control. Use nikto as a fallback for server-specific checks.

```bash
nikto -ask=no -h http://$TARGET_IP:$PORT 2>&1 | tee nikto.txt
```

## References

- [Nuclei: Overview](https://docs.projectdiscovery.io/opensource/nuclei/overview) - Template-driven scanning model and severity levels
- [Nuclei: Template Structure](https://docs.projectdiscovery.io/templates/introduction) - Template categories, tags, and how to target specific checks
- [nikto](https://github.com/sullo/nikto) - Web server scanner behavior and options